Methods and systems for automated authentication, processing and issuance of digital certificates

ABSTRACT

A computer system and process for issuing digital certificates use domain-control vetting to issue certificates. A requestor requests a certificate from a certificate authority, which identifies at least one approver to approve issuance of the digital certificate. If approved, the certificate authority accepts the request, creates and signs the certificate, and the signed certificate is sent to the requester.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a divisional of application Ser. No. 10/271,255,filed Oct. 15, 2002, which claims priority from U.S. ProvisionalApplication Ser. No. 60/328,766, filed Oct. 12, 2001, the disclosures ofeach of which are incorporated herein by reference. Application Ser. No.10/907,636, filed Apr. 8, 2005, is a co-pending divisional of Ser. No.10/271,255. A portion of the disclosure of this patent document containsmaterial which is subject to copyright protection. The copyright ownerhas no objection to the facsimile reproduction by anyone of the patentdisclosure, as it appears in the Patent and Trademark Office publicpatent files or records, but otherwise reserves all copyright rightswhatsoever.

BACKGROUND OF THE INVENTION

The present invention relates to methods and systems for identification,processing and issuance of server based digital certificates.

In order to secure information transmitted over the Internet, methodshave been developed to secure the connection between web browsers andweb servers. Secure sockets layer (SSL), recently re-named TLS butsubstantially the same protocol, is a protocol designed to enablecommunications on an insecure network such as the Internet. SSL providesencryption and integrity of communications along with serverauthentication using digital certificates. However, an SSL connectiondoes not ensure the identity of the recipient of the information nordoes it secure the information once it is decrypted at the web server.Therefore, it is important to be certain that the web server islegitimate.

It has become common practice to use web server digital certificates toauthenticate the identity of a web server to visiting browsers. A user'sbrowser will access the web server's digital certificate when directedto enter a secure session. The certificate, which contains the webserver's public key is then used by the browser to authenticate theidentity of the website, that is, the web server and to provide the webbrowser with the web server's public key so that the web browser canencrypt a session key for use in encryption of transmitted data. Sinceonly the web server has the private key to decrypt the user'sinformation, such information remains secure. The web server certificateis issued by a certification authority. Applicants' assignee, GeoTrust,Inc. is a certification authority. Most web browsers are published witha number of root digital certificates (containing public keys) for CA'salready installed and hence the web browser will recognize the CA'ssignature and trust the certificate.

Generally, in order to obtain a certificate, the website owner, theRequestor, will submit a certificate signing request (CSR), or itsequivalent, containing the web server's public key, along with otherinformation, to a certification authority (CA) and the CA, whensatisfied as to the identity of the Requestor, will issue a certificatecontaining the web server's public key and sign the certificate usingthe CA's private key. A traditional method for vetting the web serverRequestor is shown in FIG. 1. The present invention is directed tomethods and systems for automating the identification of the web serverRequestor in issuing web server certificates.

SUMMARY OF THE INVENTION

A computer system and process for automated authentication, processingand issuance of digital certificates, wherein web server domain-controlvetting is employed in the identification and authorization of theRequestor. Domain-control vetting, in accordance with the presentinvention, includes the mandatory selection of Approver contactaddresses by the Requestor wherein the Approver contact addresses, forexample, email addresses, have been generated based on domaininformation. A Requestor requests a web server certificate from acertificate authority, the certificate authority receives the request.The certificate authority generates Approver email addresses, and theRequestor is required to select an Approver email address or addresses.On the other hand, the Requestor can submit one or more email addressesand if one or more of these email addresses are also certificateauthority generated Approver email addresses, then the certificateauthority can accept the Requestor submitted email addresses that match.The certificate authority contacts the Approver using the selected emailaddress or addresses and requests that the Approver approve issuance ofthe certificate. If approved, the certificate authority accepts therequest, and creates and signs the certificate and the signedcertificate is sent to the Requestor.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows one example of the traditional vetting process.

FIG. 2 shows one preferred embodiment of the vetting process of thepresent invention, namely, the QuickSSL vetting process.

FIGS. 3 a and 3 b shows an Initial QuickSSL Premium enrollment page inaccordance with one embodiment of the present invention.

FIG. 4 shows a CSR Review and confirmation page in accordance with thepresent invention.

FIGS. 5 a and 5 b show a Order Contact information page in accordancewith one embodiment of the present invention.

FIG. 6 shows an Approval selection page in accordance with oneembodiment of the present invention.

FIG. 7 shows a Payment page in accordance with one embodiment of thepresent invention.

FIGS. 8 a and 8 b show an Order Summary and Requestor (Subscriber)confirmation page in accordance with one embodiment of the presentinvention.

FIG. 9 shows a Confirmation page in accordance with one embodiment ofthe present invention.

FIG. 10 shows a Requestor (Applicant) confirmation email in accordancewith one embodiment of the present invention.

FIG. 11 shows an Approver email in accordance with one embodiment of thepresent invention.

FIG. 12 shows an Approver review and confirmation page in accordancewith one embodiment of the present invention.

FIG. 13 shows an Approver confirmation page in accordance with oneembodiment of the present invention.

FIGS. 14 a and 14 b show a Fulfillment email in accordance with oneembodiment of the present invention.

FIGS. 15 a and 15 b show the initial certificate order pages inaccordance with a second embodiment of the present invention.

FIGS. 16 a, 16 b and 16 c show a enrollment form in accordance with asecond embodiment of the present invention.

FIG. 17 shows the enrollment form in accordance with a second embodimentof the present invention wherein a CSR has been pasted into the requiredfield.

FIGS. 18 a and 18 b show one manifestation of how the enrollment formand other pages in accordance with the second embodiment of the presentinvention are interactive and self-correcting, requiring the Requestor(Subscriber) to correct errors and add omitted but necessary informationbefore proceeding.

FIGS. 19 a, 19 b, 19 c and 19 d show the enrollment informationconformation and Subscriber Agreement process in accordance with asecond embodiment of the present invention.

FIG. 20 shows the automatic response back to the Requestor (Subscriber)who has submitted the completed certificate request properly inaccordance with a second embodiment of the present invention.

FIG. 21 shows a version of the email message the Approver receivesrequesting approval of the certificate request from the Requestor(Subscriber) in accordance with a second embodiment of the presentinvention.

FIG. 22 shows information, terms and conditions, and agreements for theApprover to agree to in approving or disapproving the certificaterequest in accordance with a second embodiment of the present invention.

FIG. 23 shows an automated notice confirming the approval of thecertificate request in accordance with a second embodiment of thepresent invention.

FIG. 24 shows the web server certificate as issued in an email afterapproval in accordance with a second embodiment of the presentinvention.

FIG. 25 shows an automated notice confirming the disapproval by theApprover in accordance with a second embodiment of the presentinvention.

FIG. 26 shows a provisioning algorithm in accordance with a secondembodiment of the present invention.

FIG. 27 shows a provisioning architecture in accordance with a secondembodiment of the present invention.

DESCRIPTION OF THE INVENTION

The aspects, features and advantages of the present invention willbecome better understood with regard to the following description withreference to the accompanying drawings. What follows are preferredembodiments of the present invention. It should be apparent to thoseskilled in the art that the foregoing is illustrative only and notlimiting, having been presented by way of example only. All the featuresdisclosed in this description may be replaced by alternative featuresserving the same purpose, and equivalents or similar purpose, unlessexpressly stated otherwise. Therefore, numerous other embodiments of themodifications thereof are contemplated as falling within the scope ofthe present invention as defined herein and equivalents thereto. Use ofabsolute terms, such as “will not . . . will,” “shall,” “shall not,”“must,” and “must not,” are not meant to limit the present invention asthe embodiments disclosed herein are merely exemplary.

This is a description for how the invention would apply to automatedidentification, processing, and issuance of digital certificates. Forexample, SSL server certificates, in this case through an Issuer's Webportal. This is only one of many potential systems, process flows andapplications for the invention.

A First Preferred Embodiment

In accordance with the present invention the automated methods andsystems for Requestor identification may be referred to asdomain-control vetting, an example of the process for domain-controlvetting is shown in FIG. 2. Domain control vetting is the process forverifying that a Requestor has permission from an Approver to obtain andinstall the product. The Approver must demonstrate control of thedomain. Thus, in the present invention the Approver is differentiatedfrom the Requestor. The Approver is an individual who has domain-controland has the responsibility for approving the Requestor's request for adomain-control vetted product (such as QuickSSL). The Requestor is theend user requesting the SSL certificate. In domain-control vetted ordersthe Requestor selects the Approver email address from a list ofauthoritative email addresses.

In initiating the request, the Requestor fills out an order formincluding Certificate Signing Request (CSR), and order contactinformation. See FIGS. 3 a, 3 b, 4, 5 a and 5 b. The Certificate SigningRequest (CSR) is a block of information typically generated by the WebServer software that is meant to be submitted to a Certificate Authority(CA) in return for a SSL certificate. The CSR provides the CertificateAuthority with the information necessary to generate the SSL DigitalCertificate. When the Web Server generates the CSR it is actuallygenerating a Private and Public Key pair. The private key is kept secretand the public key is bundled into the CSR. The CSR is digitally signedby the private key which proves to the CA that the Web Server haspossession of the private key (called “proof of possession”).

Next the Requestor is presented with a list of potential Approveremails. See FIG. 6. This list may be generated by combining domainrelated information. Disclosed below are three types of addresses whichmay be utilized. Of course there are other ways of determining theApprover's email address in accordance with the present invention. Inthis step of the process, the choices offered in the form for emailaddress for the Approver (Approver Email Address or Addresses) arelimited to those chosen by the Issuer, and cannot be altered or amendedby the Requestor. The Approver Email Address choices offered on thispage (FIG. 6) are not created by Requestor or entered into theEnrollment Form by the Requestor, and so the Requestor cannot divert or“short circuit” the approval process by directing the email messagerequesting official approval of the certificate issuance request to theRequestor or to an unauthorized person. This provides a security elementof the automated process and system of the present invention.

In the first type, the system obtains the technical and administrativecontacts from the WhoIs system—a database mandated by ICANN to bemaintained by the domain registrars. In the case the system cannotdetermine the exact role of the person it will, in certain instances,pull out any e-mail address, for example the e-mail addresses in theresponse message could be for administrative, technical, billing orother e-mail addresses.

In the second type, the following list of mail box names, namely: admin,administrator, hostmaster, info, root, ssladmin, sysadmin, webmaster, orother names, may be pre-appended to the 2, 3, 4, . . . N componentdomain of the certificate being requested. For example, if the requestedcertificate was for “us.secure.geotrust.com”, then the system inaccordance with this embodiment of the present invention would allow thefollowing: admin@us.secure.geotrust.com; admin@secure.geotrust.com; andadmin@geotrust.com for each and every of the “mail boxes” listed above.

In the third type, “standard”, fixed address sent to the CA's customersupport group (support@CA.com) where they will address this on a case bycase basis. For example, by sending it to support@ca.com orsupport@geotrust.com.

The Requestor chooses an Approver email, reviews the order information,agrees to the subscriber agreement and completes the order, includingpayment, and can review the order. See FIGS. 6, 7, 8 a and 8 b.

An e-mail is sent to the administrative and technical contactsacknowledging the receipt of the order, and the Approver e-mail is sentto the Approver. See FIGS. 9, 10 and 11. Approver receives email withembedded link to the approval site back at the CA and the Approverreviews the order information and either approves or rejects. See FIGS.11, 12 and 13. Requestor receives digital certificate (and/or otherfulfillment) via email. See FIGS. 14 a and 14 b.

A Second Preferred Embodiment

The Requestor in this embodiment is either the Web domain nameregistrant who will receive and use the SSL server certificate on thesite, or a hosting company/Internet service provider or other agentacting upon the registrant's behalf, views initial certificate orderpages and chooses to “order now.” This brings Subscriber to a detailedinstruction page, including technical assistance and hyperlinks to otherresources and instructions. To proceed, Requestor clicks on “apply now”and is taken to the next page. See FIGS. 15 a and 15 b.

The Requestor completes an Enrollment Form providing Requestor Contactand Technical Contact information (including email address) for futurecommunications from Issuer. Requestor generates a Certificate SigningRequest (CSR) through standard computer software, and pastes a copy ofthe CSR in the field indicated on the Enrollment Form to request the SSLserver certificate. This page and other pages contain relevant terms andconditions for the transaction and process (e.g., references to theapplicable Certificate Practice Statement. To proceed, Requestor clicks“submit.” See FIGS. 16 a, 16 b and 16 c. The Enrollment Form showing aCSR pasted into required field is shown on FIG. 17.

The Enrollment form and other pages in the process are interactive andself-correcting, requiring the Requestor to correct errors and addomitted but necessary information before proceeding. FIGS. 18 a and 18b.

After submitting the Enrollment Form, the Requestor is asked to confirmbasic information elements extracted from the Form, includinginformation concerning the Requestor's server's fully qualified domainname, organization, organizational unit, city, state, and country thatwas extracted from the CSR generated by the Requestor and pasted intothe form. This data is presented for approval in the exact form that itwill be inserted automatically in the SSL server certificate generatedby this process and invention. See FIGS. 19 a, 19 b, 19 c and 19 d.

The Requestor is also required to select an email address for theofficial person (the “Approver”) associated with the domain name whowill be asked to approve the issuance of the certificate with thespecific data elements contained in the CSR. See FIGS. 19 b, 19 c and 19d. In this step of the process, the choices offered in the form foremail address for the Approver, the Approver Email Addresses, arelimited to those chosen by the Issuer, and cannot be altered or amendedby the Requestor. Please note that the Approver Email Address choicesoffered on this page are not created by the Requestor or entered intothe Enrollment Form by the Requestor, and so the Requestor cannot divertor “short circuit” the approval process by directing the email messagerequesting official approval of the certificate issuance request to theRequestor or to an unauthorized person. This provides a security elementof the automated process and invention.

The Approver Email Addresses can be generated or selected according todifferent algorithms designed for security or other purposes. They maybe selected by automated and/or online processes which are also part ofthe automated process and invention, or they may be selected by off-lineprocesses. As an example, the Approver Email Addresses can be composedsome or all of the following data and algorithms: (1) elements createddynamically and automatically from Issuer or third party data sources inresponse to data or choices made by the Requestor, (2) elements createddynamically and automatically from data submitted by the Requestor, and(3) elements created dynamically and automatically or statically fromoff-line or pre-set Issuer or other algorithms. It should also be notedthat alternately, instant messaging or other such electroniccommunication means could be implemented in addition to or in place ofemail technology for this aspect to the present invention.

In this case, as shown in FIGS. 19 a, 19 b, 19 c and 19 d, the choice ofApprover Email Addresses combines all three features. For this example,the addresses in the screen shots are “billing@PHPWEBHOSTING.COM-” and“support@PHPVWEBHOSTING.COM”, which are the official contact emailaddresses listed for this domain name in the official registries. Thetwo choices in the left column under the heading “Authorized Domain NameAdministrators” were generated automatically and dynamically in realtime by looking up and recording the official listed email addresses forthe Administrative Contact and Technical Contact for the domain namethat is contained within the Certificate Signing Request (CSR) asreceived from the Registrant, as those email addresses are registeredfor the domain in one of many “WhoIs” domain name registries (the“Official Email Addresses”). The domain name can be read from the CommonName or CN field in the CSR (using X.509 format).

In another embodiment, the Requestor's domain name as entered into anenrollment form and/or as contained in the contact email addressesentered into an enrollment form submitted by the Requestor is comparedwith the domain name contained in the CN field of the CSR submitted bythe Requestor, and the application is rejected if the two names do notmatch.

In another embodiment, the Requestor's 0 or OU name(s) (organization andorganization unit), L (city), S (state or province), and/or C (country)information contained in the CN field of the CSR submitted by theRequestor is compared with the corresponding data submitted by theRequestor or other data, and the application is rejected if the twonames do not match. IN still yet another embodiment the proceedingcomparisons are both employed.

These automatic and dynamic features can (1) provide additionalprotection against fraud or mistake, (2) help ensure that the CSR isonly approved by an authorized person associated with the domain namethat is the CN of the certificate, and (3) help ensure that thecertificate is delivered to persons associated with the domain name thatis the CN in the certificate.

The process could also include an automated check of any public orprivate information source via the Internet or any other communicationsmeans, including the Issuer's own data or the data of an official orunofficial third party source, followed by a comparison and decisionprocess (e.g., approval or rejection), and this subprocess could occurat any time in the enrollment and certificate request and issuanceprocess. In accordance with this algorithm, the chance of fraud or errorin generation and delivery of the certificate to the wrong party issubstantially reduced. In this case, the checking of the Official EmailAddresses associated with the domain name contained in the CSR occursautomatically after the Requestor submits the Enrollment Form with theCSR pasted in, and the subsequent Enrollment pages were modified byusing the information obtained through that automatic checking of athird party data source.

Other Approver Email Address choices are included in three additionalcolumns to the right shown on FIGS. 19 b, 19 c and 19 d. These addresseswere selected by the issuer using the other two data and algorithmsources described above: (1) elements created dynamically andautomatically from data submitted by the Requestor; and (2) elementscreated dynamically and automatically or statically from off-line orpre-set Issuer or other algorithms. In this case, the Approver EmailAddresses listed in the three columns to the right on FIGS. 19 b, 19 cand 19 d include: (1) the Level 4 domain name contained in the CSR(i.e., elements created dynamically and automatically from datasubmitted by the Requestor) and (2) prefixes consisting of the mostcommonly-used official email contact addresses for domain names (i.e.,elements created dynamically and automatically or statically fromoff-line or pre-set Issuer or other algorithms). These alternatives areoffered in case the Requestor (which may include a hosting company orInternet service provider, as described above) wishes to choose adifferent Approver Email Address from those dynamically generated basedon the official domain name registry information (for example, becausethe domain name registrant has delegated the upkeep and operation of theassociated Web site to the hosting company or Internet service provider,who is applying for the certificate on the domain name registrant'sbehalf).

In other circumstances, the Approver Email Address choices could becomposed of all three of the data and algorithms sources describedabove, or any combination thereof, or any other relevant sources.

As shown in FIG. 19 d, the Requestor in this embodiment is required toagree to a Requestor Agreement with the Issuer before the process cancontinue. Clicking “I Agree” triggers the next step.

FIG. 20 shows an automatic response back to the Requestor who hassubmitted the completed certificate request properly, and includesinstructions for further communications. FIG. 21 shows a version of theemail message the Approver receives requesting approval of thecertificate request from the Requestor. It contains a hyperlink takingthe Approver to the Issuer's approval site. Because of the inventionfeatures described in connection with FIGS. 19 a, 19 b, 19 c and 19 dabove, this message and link to an approval page can only go to one ofthe Approver Email Addresses offered by the Issuer based on the selectedalgorithms.

The Issuer's approval site may contain additional information, terms andconditions, and agreements for the Approver to agree to, or may simplycontain a button, or other mechanism, allowing the Approver to approveor disapprove the certificate request. Because of the invention featuresdescribed in connection with FIGS. 19 a, 19 b, 19 c and 19 d above, thisapproval step can only be taken by an individual associated with one ofthe Approver Email Addresses offered by the Issuer based on the selectedalgorithms, thereby enhancing authenticity and security in thecertificate issuance process. See FIG. 22.

If the Approver approves the request, the Approver (and others, such asthe other contact persons listed in the original Enrollment Form)receives an automated notice confirming the approval. See FIG. 23.Because of the invention features described in connection with FIGS. 19a, 19 b, 19 c and 19 d above, this approval message will necessarily besent to an individual associated with one of the Approver EmailAddresses offered by the Issuer based on the selected algorithms,thereby enhancing authenticity and security in the certificate issuanceprocess.

If the Approver approves the certificate request, the Issuer'sCertificate Authority automatically and dynamically generates thecertificate and sends it by email to the Approver (and others, inaccordance with the particular embodiment, such as the other contactpersons listed in the original Enrollment Form). See FIG. 24.

A sample automated message transmitting the digital certificate is shownas FIG. 24. The message may also contain instructions or hyperlinks toinstructions for installation. Because of the invention featuresdescribed in connection with FIGS. 19 a, 19 b, 19 c and 19 d above, acopy of this certificate transmittal message will necessarily be sent toan individual associated with one of the Approver Email Addressesoffered by the Issuer based on the selected algorithms, therebyenhancing authenticity and security in the certificate issuance process.

If the Approver disapproves the request, the Approver (and others, suchas the other contact persons listed in the original Enrollment Form)receives an automated notice confirming the disapproval. See FIG. 25.Because of the invention features described in connection with FIGS. 19a, 19 b, 19 c and 19 d above, this disapproval message will necessarilybe sent to an individual associated with one of the Approver EmailAddresses offered by the Issuer based on the selected algorithms,thereby enhancing authenticity and security in the certificate issuanceprocess. In the process described in FIGS. 23, 24 and 25, if theApprover rejects the request, they can not later approve it. If theyapprove it, they can not later reject it. The state is changed.

Additional Embodiments

Alternative process feature: The Enrollment Form can request paymentinformation (e.g., credit card information) from the Requestor, and theprocess can automatically and dynamically check for paymentauthorization and post the charge upon approval of the certificaterequest by the Approver. As a further alternative, information gainedthrough the automatic payment process can be used for comparison and/orverification of other information contained in the Enrollment Formand/or CSR, and further process decisioning (e.g., accept or reject) canbe based on specific algorithms.

Having now described preferred embodiments of the invention, it shouldbe apparent to those skilled in the art that the foregoing isillustrative only and not limiting, having been presented by way ofexample only. All the features disclosed in this specification(including any accompanying claims, abstract, and drawings) may bereplaced by alternative features serving the same purpose, andequivalents or similar purpose, unless expressly stated otherwise.Therefore, numerous other embodiments of the modifications thereof arecontemplated as falling within the scope of the present invention asdefined by the appended claims and equivalents thereto.

For example, the techniques may be implemented in hardware or software,or a combination of the two. Preferably, the techniques are implementedin computer programs executing on programmable computers that eachinclude a processor, a storage medium readable by the processor(including volatile and non-volatile memory and/or storage elements), atleast one input device and one or more output devices. Program code isapplied to data entered using the input device to perform the functionsdescribed and to generate output information. The output information isapplied to one or more output devices. Each program is preferablyimplemented in a high level procedural or object oriented programminglanguage to communicate with a computer system, however, the programscan be implemented in assembly or machine language or other computerlanguage, if desired. In any case, the language may be a compiled orinterpreted language.

Still Additional Embodiments of the Present Invention

In another embodiment of the present invention the Requestor may engagea partner of the CA to assist in obtaining the certificate for theRequestor. The partner may perform varying levels of the orderingprocess workflow.

A telephone verification step could be added to the process where by theperson requesting the certificate, or the Approver are called via acomputer program and asked to enter some information that is displayedon the web browser. The intent of this is to collect another verifiedpiece of information—the phone number (in addition to the Approvere-mail address) to reduce risk and improve security while at the sametime making this an automated, quick process. The person called may berequested to say something that is then recorded by the system. Thisvoice print can be used later to verify user identity if needed (forexample, by law enforcement). At the very least, a voice recordingfurther inhibits attempts at fraud.

For example, when the Requestor gets to the order summary page andpresses confirm a new page is displayed with a code (PIN) on it and someinstructions. They are asked to be ready for a phone call at thespecified phone number (entered as part of the contact informationearlier, or from a corporate data registry (DUNS or similar), or fromthe WhoIs server data, or other sources). They agree, then the systemcalls them and asks them to enter the PIN into the phone when prompted.They are also asked to say their name and other information which isrecorded for later use. The phone system passes this PIN back to theenrollment engine where the values are compared. If successful, thesystem has verified that the Requestor is at the particular phone numberand this creates a better audit trail for finding this person later andreduces the risk of fraud.

If the Approver is the individual to be called (as opposed to theRequestor as described above), the phone call would be performed afterthey receive their Approver e-mail, come to the Approver site, reviewthe order and press the Approve button. At that point the system wouldcall them and perform the verification. If successful, the system wouldthen issue the certificate.

Another embodiment of the present invention would also employ corporateregistration data. A record for each order/company in a publicregistration database would be created or accessed with a globallyunique identifier with user disclosed information about them or theircompany—much like DUNs numbers today (www.dnb.com). This is currently aperceived important aspect of traditional vetting where companies arehighly encouraged to get a DUNs number by self-reporting someinformation about the company. This would preferably be a globallyunique ID that can be used to track the certificate back to someadditional identifying profile information.

This profile data would be linked to and from the certificate (whichwould have the number included, and probably the URL to the data), andperhaps elsewhere at the CA. Users would be able to opt-out of this databeing published if they desired. The CA would collect the information,post to this repository, create or obtain the globally unique number,and include it in the certificate for the user. Currently users need togo and do this prior to requesting the certificate, so this is aquicker, easier process. Finally, if users have a number already, theycan enter it during enrollment and the CA would link to that previouslyregistered entity.

Use of DNS server ownership for verifying domain-control. In the case aCA partner is hosting the Requestor's web site, such service normallyincludes entering and maintaining the DNS entry. This is a mappingbetween the domain name and the IP address where the server actuallyresides. Every web connection made by a browser looks up the domain namein a DNS server, obtains the IP address, and then connects to that IPaddress. If an entity has control over the DNS server for this domain,it has control over the domain.

If a request for a certificate for domain name “domain.com” is from apartner (Partner A), the CA can do a DNS look-up and find theauthoritative DNS server for this domain. The CA can compare this withthe list of DNS servers registered with us for Partner A. If they match,the CA can automatically approve the request, generate the certificateand e-mail to the requester, tech, billing and Partner A registeredcontact, or send an approval e-mail to a previously registered e-mailaddress for Partner A. As before, it should also be noted thatalternately, instant messaging or other such electronic communicationmeans could be implemented in addition to or in place of emailtechnology for this aspect to the present invention.

Each such computer program is preferably stored on a storage medium ordevice (e.g., CD-ROM, hard disk or magnetic diskette) that is readableby a general or special purpose programmable computer for configuringand operating the computer when the storage medium or device is read bythe computer to perform the procedures described in this document. Thesystem may also be considered to be implemented as a computer-readablestorage medium, configured with a computer program, where the storagemedium so configured causes a computer to operate in a specific andpredefined manner. For illustrative purposes the present invention isembodied in the system configuration, method of operation and product orcomputer-readable medium, such as floppy disks, conventional hard disks,CD-ROMS, Flash ROMS, nonvolatile ROM, RAM and any other equivalentcomputer memory device. It will be appreciated that the system, methodof operation and product may vary as to the details of its configurationand operation without departing from the basic concepts disclosedherein.

1. A method for issuance of a digital credential by a certificateauthority, the method comprising: receiving, by the certificateauthority, a request for a digital credential from a requestor, whereinthe digital credential is for an internet site with a domain name;subsequent to the receiving, identifying at least one approver toapprove issuance of the digital credential, wherein the identifying theat least one approver includes obtaining contact information for the atleast one approver from a third entity, and wherein the at least oneapprover is associated with the internet site; contacting an identifiedapprover using the contact information to obtain approval for issuanceof the digital credential to the requestor; receiving a response fromthe approver; and issuing a digital credential upon receipt of approvalfrom the approver.
 2. The method of claim 1, wherein the submittingincludes submitting a certificate signing request (CSR).
 3. The methodof claim 1, wherein the requestor is a hosting company that makes arequest to obtain a digital certificate for a web site registrant. 4.The method of claim 1 wherein the third entity is the WhoIs system. 5.The method of claim 1, wherein obtaining the contact informationincludes transmitting the domain name to the third entity and receivingthe contact information.
 6. The method of claim 5, wherein the contactinformation includes one or more e-mail addresses.
 7. The methodaccording to claim 1, wherein the processes of the certificate authorityare performed by a microprocessor and in an automated manner.
 8. Themethod according to claim 1, wherein the third entity is a dataregistrar, and further comprising the certificate authority obtaininginformation about the requestor from the data registrar.
 9. The methodaccording to claim 8, wherein the process of the certificate authorityobtaining information about the requestor from the data registrar isautomated.
 10. The method according to claim 8, wherein the informationabout the requestor obtained from the data registrar is used by thecertificate authority to identify the at least one approver.
 11. Themethod according to claim 1, wherein the identifying of the at least oneapprover includes generating a list of one or more approvers, andfurther comprising: providing the list to the requestor; and therequestor selecting an approver for the certificate authority to contactfrom the approver list.
 12. The method according to claim 11, whereinthe list includes contact information for each approver, including ane-mail address.
 13. The method according to claim 1, wherein the digitalcredential is requested for a server.
 14. The method according to claim13, wherein the server is a web server.
 15. The method according toclaim 13, wherein the credential is a digital certificate.
 16. Themethod of claim 1, wherein the requestor is a web domain nameregistrant, and the credential is an SSL server certificate.
 17. Themethod of claim 16, wherein the requestor selects an email address forthe approver associated with the domain name, wherein the submittingincludes submitting a certificate signing request (CSR), and wherein theapprover is asked to approve the issuance of a digital certificate withdata elements contained in the CSR.
 18. A computer readable mediumencoded with a plurality of instructions for controlling a computingsystem to perform a method for issuance of a digital credential by acertificate authority, the instructions comprising: receiving, by thecertificate authority, a request for a digital credential from arequestor, wherein the digital credential is for an internet site with adomain name; subsequent to the receiving, identifying at least oneapprover to approve issuance of the digital credential, wherein theidentifying the at least one approver includes obtaining contactinformation for the at least one approver from a third entity, andwherein the at least one approver is associated with the internet site;contacting an identified approver using the contact information toobtain approval for issuance of the digital credential to the requestor;receiving a response from the approver; and issuing a digital credentialupon receipt of approval from the approver.
 19. The computer readablemedium of claim 18, wherein the third entity is the WhoIs system. 20.The computer readable medium of claim 18, wherein the identifying of theat least one approver includes generating a list of one or moreapprovers, and further comprising: providing the list to the requestor;and the requestor selecting an approver for the certificate authority tocontact from the approver list.
 21. The computer readable medium ofclaim 20, wherein the list includes contact information for eachapprover, including an e-mail address.
 22. The computer readable mediumof claim 18, wherein obtaining the contact information includestransmitting the domain name to the third entity and receiving thecontact information.
 23. The computer readable medium of claim 22,wherein the contact information includes one or more e-mail addresses.